Direct answer
Use your organization's reporting function to preserve a suspected phishing message and its context. Keep original message data available to authorized investigators, restrict access and avoid opening links or attachments during collection.
Capture the context
Record the recipient, time, business context, claimed sender and requested action. Note whether anyone clicked, entered information, downloaded a file or merely received the message. These distinctions help responders choose containment steps.
If an organization has a reporting button or mailbox, follow that process rather than forwarding an active link into an ordinary chat.
Reference: CISA: Recognize and report phishing.
Preserve the original when permitted
Screenshots help explain what a user saw but can omit full headers and message structure. Authorized responders may request the original message or a supported export from the mail system. Use the documented collection method and record who collected it and when.
- Do not open an attachment to determine its contents.
- Retain a copy in the approved restricted incident location.
- Record any handling or transformation of the evidence.
Share a minimized working summary
An email may contain names, addresses, internal references and credential-reset links. Give the wider team a redacted summary with the incident identifier, suspected tactic and recommended action. Keep sensitive originals available only to the people who need them.
Reference: NIST SP 800-61 Rev. 3: Incident response recommendations.
Connect evidence to action
The response owner can compare similar reports, identify affected recipients and check mail-system logs within authorized scope. A screenshot or one suspicious domain does not prove a mailbox was compromised. Record uncertainty and what additional evidence would change the conclusion.
Assessment limits
Message headers and content can be forged or incomplete. Evidence handling depends on organizational policy, applicable law and the mail system; a preserved email does not prove a particular sender or compromise.
Frequently asked questions
Is a screenshot enough for every investigation?
It can show the user-visible message, but may omit headers and message structure. Ask the incident team what original evidence it needs.
Should I send the link to coworkers as a warning?
Use an approved reporting process and a sanitized description, so the warning does not spread a clickable suspicious link.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.